Disclosure tiers

One vehicle, three audiences

A buyer, a dealer and an authority are entitled to see different things about the same car. The holder of the passport hands each of them a bundle: a file that opens some of the vehicle's committed values and nothing that opens the rest. This page checks every value in each bundle against the commitment the ledger holds for it, in your browser, with the same code the command line and the tests run. No server decides what you see.

Which ledger this checks against. The demo record: the compiled contract run locally by scripts/export-demo-state.mjs, the same record the scan page reads for the 2019 Golf. It is not preprod. The three bundles were written in the same run, because the salts that open these commitments exist nowhere else.
01 · Choose who is asking

What each one receives, checked

Loading the bundles and the demo ledger.

02 · Why a bundle cannot open more

Bounded by arithmetic, not by a promise

Each salt stands alone

Every committed value is hidden under its own salt, derived from a seed the holder never hands over. A bundle carries the salts for the fields it opens and no others, and one salt says nothing about the next, so the file itself is the proof of what it can open.

The reader recomputes the tier

A bundle names its tier, and the reader does not take its word for it. Every field's tier comes from the reader's own copy of the policy, and anything above the declared tier is flagged. The tool that builds bundles refuses such a field outright.

A claim counts only if current

The buyer's bundle cites claims already proven on the ledger, such as never written off, which reveal a bound and never a value. A claim is accepted only if it is about this vehicle and was proven against the value the ledger holds now.

03 · What this does not do

Stated, so nobody has to find it

  • A bundle cannot be recalled. Once handed over, the values in it are known to whoever holds it. What the ledger records is who was granted which view, by the vehicle's registrar (grantDisclosure, shown here on the demo record and reaching preprod with the next deployment). That makes a disclosure auditable, never reversible.
  • Which audience sees which field is our design for now. The access conditions for a circularity passport are left to an implementing act under Reg (EU) 2026/1738 Art. 13(6)(d), due by 14 August 2030 and not yet adopted. The tiers will be revisited when it is.
  • Presence is not private. Anyone can tell which fields this vehicle has on the ledger, because each field's slot follows from public anchors. That is how this page lists what a bundle leaves closed. The values stay hidden.
  • The registrar decides who is given a tier today. The keeper's consent is not modelled in the contract yet.
04 · Check it yourself

The same answer from the command line

Clone the repository, install, and check any of the three files against the same ledger:

node scripts/disclose.mjs --verify site/disclose/bundles/trade.json --against site/verify/demo-data.json

The policy is scripts/lib/tiers.mjs, one tier for each of the 68 fields, and the reasoning is decision D26 in docs/DECISIONS.md.